Help - Search - Members
Full Version: Question about avp.exe
Kaspersky Lab Forum > English User Forum > Protection for Home Users > Kaspersky Internet Security & Anti-Virus for Windows
I just noticed that on my task manager's process list there are two avp.exe running. Also, one of them shows a huge number of page faults (11 million in 18 hours). Is is normal to have two avp.exe and that many page faults?
I upgraded to KAV 7 from KAV 6 a couple of days ago and since that time my free memory goes down significantly after a few hours (about 150 mb less memory than before the upgrade). I'm not sure if it is because of KAV, however, because I also upgraded Firefox on the same day. I would appreciate any help... My system runs on XP sp2 pro.
Yes it is normal to have two of them running at the same time. One is the actual scanner and the other one is GUI tray component. I have approx ~1 million of faults. Something is definately conflicting on your machine as the RAM usage is not very high for me. Can you post the GSI log, how to do it is posted on the top of this forum.
Thank you for your response! I should have clarified that neither of the two avp.exe seems to consume a lot of memory (task manager shows that one is 2.6 MB and the other approx. 8MB). I now think that the problem is Firefox and not KAV. The 150mb memory loss seems to happen when I use Firefox. I tried rebooting and not using Firefox for a while...memory was fine just like before the upgrade. As soon as I used Firefox, memory was reduced by over 100mb (even after exiting Firefox). So, I doubt that it's because of KAV. Thank you for explaining the two instances of avp.exe...

Well...I shouldn't have concluded that the problem was not related to KAV so quickly. Here is an update:

It seems that the loss of free memory is because of a huge KAV log file that is created every time I use firefox. That's the proactive defense event log. Within 20 hours, the file was over 200 MB and free memory was reduced by over 100 MB. When I clear the log file, the free memory is recovered. Trying it again, I noticed that the log file was about 11 MB after using firefox for about 45 minutes. This doesnt happen with other programs (e.g., email) ut only with firefox. The log (Proactive defense--Events) contains numerous entries (about 4-5 per second) like the following:

8/18/2007 1:10:48 PM E:\Browser\FireFox\firefox.exe Attempt to load a new or modified module C:\Documents and Settings\Mns\Local Settings\Application Data\Mozilla\Firefox\Profiles\nsuvt0ib.default\XPC.mfl into process.
8/18/2007 1:10:48 PM E:\Browser\FireFox\firefox.exe Action allowed.

The process that firefox is trying to load is different every time and it looks like most of these are firefox extensions.

I could try, of course, disabling proactive defense but I would like to be able to continue using that feature. Any suggestions?
In settings, reports and data files section, please untick "Log non critical events" and tick "keep only recent events".

This should keep the logfile sizes down.
you should disable logging in proactive defense's application integrity control


Thank you for your replies!

MAPKOBKA^^: I already tried disabling "log non-critical events" and it did help a little but I still get those multiple entries in the log. ("Log onl recent events" was already checked.)

wulfe: I will try disabling the application integrity control log for Firefox (since only firefox seems to be the problem). If I understand this orrectly, the way to do this is by going to APIC settings, highlighting Firefox in the list of trusted applications, and clicking on "log event" for "Content Change" and "Run as child" to make it "do not log event". Is that right? The "execute" already shows "do not log event."

Wonnov Menny
What are page faults? Do they accumulate in task manager or does the counter reset after each time the PC is switched-on?

This PC has been on for around 1.5 hours, I just checked task manager, which shows:-

avp.exe - mem usage: 11,672K - page faults: 1,955,687
avp.exe - mem usage: 4,284K - page faults: 206,350

the 1st avp.exe is continually counting up page faults (many per second) but the 2nd avp.exe stays at 206,350.

King Grub
A "page fault" is not an error. Every time a process looks for any kind of data in memory, and that data is not there, that's called a "page fault". The operative system then loads that into memory from the hard drive. Normal operating system processes, in other words, and no errors at all. Poorly named, perhaps.
Well...I want to report that after disabling Application Integrity Control logging for Firefox, the problem was solved. There is no longer any meory loss and the log file is a reasonable size.
However, I am a bit puzzled by this because it was not happening with KAV 6....

Latest Firefox is known to memory leaks, from what I heard smile.gif
Not to Hijack the thread but I have a similar problem with IE 7.

Problem: (2) avp.exe's running one goes to 8mil plus page fault and climbing. That avp stays at ~50% cpu use.

Asrock mb
2 gig corsair ddr2
seagate 300 gig sata
winxp sp2
Complete scans done etc.

I have been blaming superanitvirus and superadblocker but it is KIS 7.125.
I uninstalled SAS and SAB.

It seems to be a timing thing meaning boot versus icon activation.
Using win task manager after boot and avp goes nuts with page faults and cpu use to ~50. Close the processes. Check all processes and cpu usage `1-2 idle. Click on KIS icon on the desktop and runs fine, 2 avp's and minimal cpu usage.

Why only on boot?
Don Pelotas
Because it does a startup scan when can if you wish uncheck this option in the settings.
QUOTE(Don Pelotas @ 19.08.2007 10:41) *
Because it does a startup scan when can if you wish uncheck this option in the settings.

No, the enormous number of page faults is not just compiled during booting. I see the highest Page Faults on both our Thinkpads/XP Pro SP2 for one of the (usually two) avp.exe processes, on the order of a million faults. In fact, over the past hour I have an increment of 3/4 million page faults on one avp.exe process.
Lucian Bara
those page faults count the number of times data is retrieved from the disk because it's not in the memory. obviously, the files kav has to scan are not in the memory, they are files.
QUOTE(Lucian Bara @ 16.11.2007 20:06) *
those page faults count the number of times data is retrieved from the disk because it's not in the memory. obviously, the files kav has to scan are not in the memory, they are files.

Fully agree. Why people do scowl at page faults ? It is just regular system activity, all the more when a process is scanning something (memory, files...) has to map somehow. First of all I wouldn't take page faults (unexpensive overhead, for inst. when it is about to map a new file in memory) for process swap-in (expensive).
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2017 Invision Power Services, Inc.